Unsecured Credentials
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
Every observable in the brief belongs to a child. AN1153's usable arm is 'reg query'/'findstr' for secrets (T1552.001/.002); AN1154 is bash_history and /etc/shadow (T1552.003, and /etc/shadow is really T1003.008); AN1155 is Keychain access (T1555.001); AN1158 is /run/secrets (T1552.007); AN1159 is device config dumps. Two of AN1153's three log sources are structurally incapable of the described behaviour anyway -- Sysmon EID 11 is file creation, not read, and EID 13/14 are registry writes, so neither can observe credential discovery. Confirmed independently by two authoring agents in separate waves.
Covered instead by T1552.001, T1552.002, T1552.003, T1555.001.
What the technique is
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1153
Unusual access to bash history, registry credentials paths, or private key files by unauthorized or scripting tools, with correlated file and process activity.
- AN1154
Reading of sensitive files like.bash_history, /etc/shadow, or private key directories by unauthorized users or unusual processes.
- AN1155
Unusual access to ~/Library/Keychains, ~/.bash_history, or Terminal command history by unauthorized processes or users.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.